Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 784 Comm: kworker/0:2 Not tainted 6.12.0-rc6-syzkaller-00192-gf1dce1f09380 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events swap_reclaim_work RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49 Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b1 e5 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8 RSP: 0018:ffffc90001797b00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8880431ae080 RCX: ffff88801f9c2440 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008 RBP: ffff8880431ae078 R08: 0000000000000003 R09: fffff520002f2f64 R10: dffffc0000000000 R11: fffff520002f2f64 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc9000106e000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f820050d538 CR3: 00000000433dc000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_move_tail include/linux/list.h:310 [inline] swap_reclaim_full_clusters+0xf3/0x3c0 mm/swapfile.c:748 swap_reclaim_work+0x32/0x40 mm/swapfile.c:779 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0x23/0x140 lib/list_debug.c:49 Code: 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 49 89 ff 49 bc 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 b1 e5 3a fd 49 8b 5f 08 4c 89 f8 48 c1 e8 RSP: 0018:ffffc90001797b00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff8880431ae080 RCX: ffff88801f9c2440 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008 RBP: ffff8880431ae078 R08: 0000000000000003 R09: fffff520002f2f64 R10: dffffc0000000000 R11: fffff520002f2f64 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc9000106e000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f820050d538 CR3: 00000000433dc000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: f3 0f 1e fa endbr64 b: 41 57 push %r15 d: 41 56 push %r14 f: 41 54 push %r12 11: 53 push %rbx 12: 49 89 ff mov %rdi,%r15 15: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 1c: fc ff df 1f: 48 83 c7 08 add $0x8,%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 05 je 0x36 31: e8 b1 e5 3a fd call 0xfd3ae5e7 36: 49 8b 5f 08 mov 0x8(%r15),%rbx 3a: 4c 89 f8 mov %r15,%rax 3d: 48 rex.W 3e: c1 .byte 0xc1 3f: e8 .byte 0xe8